I think I've sorted it now by trial and error I just wish Draytek would put more information in their instructions and update them when needed.

At first I put the 'block' in the general setup of the firewall section and this does work for the entire network BUT you cant add any allow rules as they just dont work.

Instead you need to put the 'block' in the filter setup but this is where the problem started, when you choose block or block if no further match the CSM section greys out doesnt let you choose the profile you've created.

What you need to do is create 2 CSM profiles and allow them both to pass immediatly, one with all the options ticked (this will create the block) and one with the services you want to use. So even though your 'passing' the profile it actually 'blocks'. This only works if you put the allow before the disallow confusing or what?